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CN . Abstract 



. We give an efficient randomized algorithm for approximating an arbitrary element of 5/7(2) by a product 

^SJ ' of Clifford+r operators, up to any given error threshold e > 0. Under a mild hypothesis on the distribution 

of primes, the algorithm's expected runtime is polynomial in log(l/e). If the operator to be approximated is a 
^ ' 2-rotation, the resulting gate sequence has T-count K + 41og2(l/e), where K is approximately equal to 11. We 

also prove a worst-case lower bound of K' + 41og2(l/e), where K' = —9, so that our algorithm is within an 
additive constant of optimal for z-rotations. For an arbitrary member of 5(7(2), we achieve approximations with 
' T-count JiK + 121og2(l/e). By contrast, the Solovay-Kitaev algorithm achieves T-count 0(log'^(l/e)), where c is 

approximately 3.97. 



Q_i 1 Introduction 



The decomposition of arbitrary unitary operators into gates from some fixed universal set is a well-known problem 
d in quantum information theory. If the universal gate set is discrete, the decomposition of a general operator can 
^ , only be done approximately, up to a given accuracy e > 0. Here, we focus on the problem of approximating single- 
qubit operators using the ClifFord+T universal gate set. The Clifford-t-T gate set is of particular interest because 
it is known to be suitable for fault-tolerant quantum computation. Recall that the Clifford group on one qubit is 
generated by the Hadamard gate i7, the phase gate S, and the scalar a; — It is well-known that one obtains a 

universal gate set by adding the non-Clifford operator T. 



' We present an efficient randomized algorithm for approximating an arbitrary element of SU{2) by a product 

. of Clifford-t-T operators, up to any given error threshold e > 0. Under a mild hypothesis on the distribution of 
primes, the algorithm's expected runtime is polynomial in log(l/e). The algorithm approximates any z-rotation with 
r-couni0 4 log2(l/e) + constant, where the additive constant is approximately equal to 11. We also prove a worst-case 
lower bound of K' + 41og2(l/e), where K' ~ —9, so that our algorithm is within an additive constant of optimal for 
, 2;-rotations. For an arbitrary member of SU{2), we achieve approximations with T-count 3K + 121og2(l/e). 
^ ' By contrast, the Solovay-Kitaev algorithm 0151 [2], which is the de facto standard algorithm for this problem, 

- - - produces circuits of T-count 0(log'^(l/e)), where c is approximately 3.97. Thus, we have decreased the exponent 
in the gate complexity from c = 3.97 to c = 1, which is optimal. Moreover, we have decreased the multiplicative 
constant to the theoretical optimum, in the case of arbitrary z-rotations. 



1.1 Related work 

For the last 17 years and until a few months ago, the state-of-the-art solution to the approximation problem was the 
Solovay-Kitaev algorithm [5l [6l [2] . There are various variants of this algorithm. Perhaps the best- known variant is 
the one described in [5], which achieves a gate complexity of 0(log'^(l/e)), for c « 3.97. Another well-known variant 
is described in Kitaev et al. [BJ Sec. 8.3], and achieves c = 3 + S, where (5 > is any positive real number. Kitaev et al. 
also gave another algorithm that uses ancillas and achieves gate complexity 0(log^(l/e) loglog(l/e)) [SI Sec. 13.7]. 

'^We follow [l] in using T-count, rather than the overall gate count, as a convenient measure for the length of a single-qubit Clifford+T 
circuit. This is justified, on the one hand, because the fault-tolerant implementation of T-gates is far more resource intensive than that 
of Clifford gates, and on the other hand, because consecutive Clifford gates can always be combined into a single Clifford gate, so that 
the overall gate count is almost exactly equal to twice the T-count. 
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At the other end of the spectrum, there is a known information-theoretic lower bound of c = 1 for the exponent 
in the gate complexity. One can make this lower bound more precise: in fact, the decomposition of a typical SU(2) 
operator into the Clifford+T gate set with accuracy e requires T-count at least K + 31og2(l/e), for some constant 
K. This follows from a result of Matsumoto and Amano [S], who showed that there are precisely 192 • (3 • 2" — 2) 
distinct single-qubit Clifford+T-circuits of T-count at most n, along with the fact that SU{2) is a 3-dimensional 
manifold, thus requiring il{l/e^) epsilon-balls to cover. Heuristically, it appears that, for most operators, this lower 
bound can in fact be achieved by approximation algorithms based on exhaustive search, such as Fowler's algorithm 
[3]. However, such exhaustive search based algorithms have runtimes that are exponential in 1/e. 

Recently, Duclos-Cianci and Svore announced an alternative to the Solovay-Kitaev algorithm that requires ancillas 
to be prepared in special resource states, using a state distillation procedure 3 . Using this method, and dependent 
on the particular setting, they reduced the gate complexity exponent c to between 1.12 and 2.27. 

Even more recently, in an important milestone, Kliuchnikov, Maslov, and Mosca gave an approximation algorithm 
for single-qubit operators that has polynomial running time and achieves gate counts of 0(log(l/e)), thus reducing 
the gate complexity exponent to c = 1 |7j. The Kliuchnikov-Maslov-Mosca approximation algorithm is therefore 
asymptotically optimal. It uses a fixed, small number of ancilla qubits to approximate a given single-qubit operator. 
Unlike approaches based on resource states, the ancillas in the Kliuchnikov-Maslov-Mosca algorithm are initialized 
to |0), and are returned in a state very close (but not exactly equal) to |0); these ancillas do not require any special 
preparation procedure. 

For all practical purposes, this use of ancillas in the Kliuchnikov-Maslov-Mosca algorithm causes no difficulties. 
However, the question remained open whether there exists an asymptotically optimal, efficient single-qubit approxi- 
mation algorithm that requires no ancillas, and thus solves exactly the same problem for the Clifford-|-T gate set as 
the Solovay-Kitaev algorithm. The present paper achieves such an algorithm. 

1.2 Limitations 

Unlike the Solovay-Kitaev algorithm, which can be applied to any universal gate set, the algorithm of this paper 
is specialized to the Clifford-|-T gate set. It is an open question whether a similar approach would work for other 
universal gate sets as well. 

Technically, the expected polynomial runtime of the present algorithm is contingent on a number-theoretic as- 
sumption about the distribution of primes, as stated below in Hvpothesis 1281 I am not an expert on the distribution 
of prime numbers, and do not know, as of this writing, whether this hypothesis is known to be true or not. Therefore, 
this has been left open. 

The lower bound of K' + 41og2(l/e) for the T-count of e- approximations to certain z-rotations only applies to 
the problem as stated, i.e., for writing operators as a product of 2 x 2-Clifford+T operators. It is conceivable that 
by the use of other techniques, such as ancillas, resource states, or online measurement, even smaller T-counts can 
be obtained. However, no method for doing so is currently known. 



2 Overview of the algorithm 

The algorithm can be summarized as follows. Consider the ring 

D[w] = i] = {^-^{auj^ + buj'^ + oj + d) \ k e a, b,c,de Z}. (2) 

As shown by Kliuchnikov, Maslov, and Mosca [5|, a unitary operator U G U{2) can be exactly synthesized over the 
Clifford-f-T gate set (with no ancillas) if and only if all the matrix entries belong to the ring ©[oj]. Moreover, the 
required number of T-gates is at most 2k, where fc ^ is the minimal exponent required to write all entries of U in 
the form mentioned in ([2]). 

Suppose we wish to approximate a given z-rotation 

RM-e-'^'^^[^-;'\,l). (3) 

up to a given e > 0, using Clifford+T gates. We will choose an integer k and a randomized sequence of suitable 
elements u e Z[uj] such that — ^ « e~*^/^. For each u, we attempt to solve the Diophantine equation 

v2 

ttt+uut^2''\ (4) 



2 



with t G Z[a;]. The parameters are chosen in such a way that this succeeds for a relatively large proportion of the 
available u. This yields a unitary matrix 

with \\U — Rz{6)\\ ^ e, and such that the coefficients of U are in the ring II>[uj]. By the Kliuchnikov-Maslov-Mosca 
exact synthesis algorithm, U can be exactly decomposed into ClifFord+T gates with T-count at most 2k. The 
remainder of this paper fills in the details of these ideas: in particular, how to choose k, how to find "suitable" u, 
and how to solve the Diophantine equation Q with high probability. 

3 Some algebra 

3.1 Some rings of algebraic integers 

Recall that N is the set of natural numbers including 0. Let uj = e*'^/^ = (1 + i)/^/2. Note that uj is an 8th root of 
unity satisfying lo'^ — i and uj'^ — —1. We will consider the following rings: 

• Z, the ring of integers; 

a,b Cz Z}, the ring of quadratic integers with radicand 2; 

• Z[i] = {a + bi \ a,b Cz Z}, the ring of Gaussian integers] 

• Z[ti;] = {aw^ + buj^ + cui + d \ a,b,c,d E Z}, the ring of cyclotomic integers of degree 8. 

Remark 1. We have the inclusions Z C Z[\/2] C Z[cj] and Z C Z[z] C Z[w]. Of course, all four rings are subrings of 
the complex numbers. 

3.2 Conjugate and norm 

Definition 2 (Conjugation). Since is a 4th root of —1, the ring Z[aj] has four automorphisms. One of these is 
the usual complex conjugation^ which we denote (— )^. It maps i to — i, and \/2 to itself. Equivalently, it is given by 
= —(J^. It acts trivially in Z and Z[\/2], and non-trivially on Z[a;] and Z[i], with the following explicit formulas, 
for real a, b, c, d: 

{auf^ + buj^ + cuj + d)^ = —cuj^ — buj^ — aw + d, (6) 
{a + bi)"^ ^ a-bi. (7) 

Another automorphism is ^/2- conjugation, which we denote (— )*. It maps ^/2 to —a/2, and i to itself. Equivalently, 
UJ* — —oj. It acts trivially on Z and Z[i], and non-trivially on Z[a;] and Z[-\/2], with the following explicit formulas, 
for rational a, b, c, d: 

{auj^ + boj"^ + ccj + d)' = -aoj^ + - co; + rf, (8) 
(a + bV2y = a - bV2. (9) 

The remaining two automorphisms are, of course, the identity function and (— = (^)*^- 

Remark 3. For t e Z[w], we have t e Z[V2] iS t ^ t'< , t e Z\i] iff t = f, and i e Z iff t = <t and t = t'. 

Definition 4 (Norms). We define an integer- valued (number-theoretic) norm on each ring: 

• For t = a + bi <E I^li], let 

^^^{t)^tt'^ ^a^ + b^. (10) 

• For t = a + 5V2 G Z[V2], let 

J\f^{t) ^ tf ^a^- 262. ^^^^ 

• For t = aoj^ + buj^ + cuj + d e Z[u}] , let 

JV^t) = tt\tt^)' = (a^ + b^ + c^ + d^f - 2(ab + bc + cd- daf . (12) 
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For consistency, we also define Afi{t) — t for t E Z. 

Remark 5. Afi and Afui are valued in the non-negative integers, but Afi and Af^ may take negative values. Each 
norm is multiplicative, in the sense that Af{ts) = J\f{t)JV{s) for all t, s. Moreover, Af{t) = if and only if t = 0, and 
Af(t) = ±1 if and only if t is a unit (i.e., an invertible element) in the ring. The latter property follows easily from 
multiplicativity and the fact that equations (IT0HT2l) define an inverse for t when M{t) = ±1. 

3.3 Euclidean domains 

Remark 6. Z, Z[x/2], Z\i], and Z[ uj] are Euclidean domains. Explicitly, for each of these rings, a Euclidean function 
is given by |A/'(i)|. For given elements s and i 7^ 0, the division of s by i with quotient q and remainder r can be 
defined by first calculating q' = s/t in the corresponding field of fractions (respectively Q, (Q)[V2], and 
q' can be expressed with rational coefficients as a, a + a + bi, or ui^a + uj'^b + cue + d, respectively. Then q is 
obtained from q' by rounding each coefficient a, 6, c, d to the closest integer, and r is defined to be qt — s. One may 
verify that in each case, |A/'(r)| ^ ^|A/'(t)|. 

As usual, we write i | s to mean that t is a divisor of s, i.e., that there exists some r such that rt — s. We also 
write t ^ s to indicate that t \ s and s | i; in this case, t and s differ only by a unit of the ring, and we say t and s are 
associates. 

Remark 7. We note that if R is one of the four rings Z, Z[-\/2], Z[i], and Z[a;], and rt = s for some s,t £ R and 
r S Z[a;] with t ^ 0, then r G R. This is easily proved by letting R be the corresponding field of fractions (respectively 
Q, Q[-\/2], Q[«], and Q[w]), and noting on the one hand that r = | S i?, and on the other hand that R = Z[w] n R. 
The latter property follows from Remark [S] 

In particular, it follows that t \ s holds in R if and only if i | s holds in 1i[uj], so that the notion of divisibility is 
independent of R. 

Remark 8. Every Euclidean domain admits greatest common divisors, which can be calculated by repeated divisions 
with remainder via Euclid's algorithm. Note that greatest common divisors are only unique up to a unit of the ring. 
Also note that, since each division by t with remainder r satisfies |A^(r)| ^ ^|A/'(t)|, the computation of the greatest 
common divisor of two elements of any of the above rings requires at most 0(log |A/'(t)|) divisions with remainder. 

An element t of a Euclidean domain is called prime (or irreducible) if t is not a unit, and for all r, s with rs — t, 
either r or s is a unit. We note that the notion of primality is not independent of the ring. For example, 7 is prime 
in Z, but not in Z[V2], as 7 = (3 + \/2) (3 - \/2) . 

Remark 9. In each of the above rings, if Af{t) is prime in Z, then t is prime in the ring. Indeed, suppose t = rs. 
Since JV{t) — Af{r)M{s), either Af{r) or Af{s) is ±1, hence r or s is a unit. 

3.4 Units in Z[V2] 

Lemma 10. The units o/Z[\/2] are exactly the elements of the form (— 1)"(\/2 — 1)'^, where n,k E Z. A unit u is 
a square if and only if u ^ and u' ^ 0. 

Proof. We first note that {^/2— — 1, so \/2— 1 and v^-l- 1 are units. Now consider any unit w = a + 6-\/2 G 
Z[V2]. We prove the first claim by induction on The base case is 6 = 0; in this case, A{^{u) = c? = ±1 implies 
u ^ a~ ±1. For the induction step, note that A^(m) — a"^ — 2b^ — ±1 implies a ^ and < 2P + 2 < 46^, hence 
< |a| < \2b\. First consider the case where a, b have the same sign. Then |a — 5| < |5|, and the claim is proved by 
applying the induction hypothesis to u' = u(\/2 — 1) = 26 — a + (a — b)y/2. The case where a, b have opposite signs 
is similar, except we use |a + 6| < |&| to apply the induction hypothesis to u' — uj (\/2 — 1) = a + 26 + (a + 6)-\/2. 

For the second claim, note that u ~ (— 1)"(V2 — 1)'^ satisfies m ^ iff n is even, and u* ^ iff n + fc is even. 
Therefore u is a square iff n and k are both even, iff u ^ and u* ^ 0. □ 

3.5 Roots of -1 in Z/(p) 

Remark 11. Let p e Z be a positive prime satisfying p = 1 (mod 4). It is well-known that there exists h G Z 
such that h'^ + 1 = (modp). We recall that there is an efficient randomized algorithm for computing h. Consider 
the field Z/{p) of integers modulo p. By Fermat's Little Theorem, all non-zero 6 G Z/(p) satisfy 6^^^ — 1, hence 
5(p-i)/2 = Because each of the polynomial equations b'^P^^')^^ — 1 and b'-P^'^^^ ^ —1 has at most {p — l)/2 
solutions, b^P^^y^ = —1 holds for exactly half of the non-zero 6 e Z/{p). Therefore, one can efficiently solve 
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l){p i)/2 — —1 by picking b at random until a solution is found; on average, this will require two attempts. Note that, 
by the method of repeated squaring, the computation of fe(p^i)/2 only requires O(logp) multiplications. Finally, we 
can set h = &(p-i)/4. 



4 A Diophantine equation 

We will be interested in solving equations of the form 

ttt = ^, (13) 

where ^ € Z[%/2] is given and t e Z[uj] is unknown. Writing = x + yV2 and t = aut^ + buJ^ + cuj + d, we can 
equivalently express (|13|) as a pair of integer equations: 

+ b^ + +d^ = X (14) 
ab + be + cd — da = y. (15) 

Of course, not every e Z[\/2] can be expressed in the form (fT3|). However, we have the following: 

Theorem 12. Let = x + y\f2 G Z[\/2], where x is odd, y is even, ^ 0, ^ 0, and p = ^ x^ — 2y^ is prime 
in 1. Then there exists t G Z[a;] satisfying Iil3\) . Moreover, there is an efficient randomized algorithm for computing 
t. 

Remark 13. Since tt^ = ^ implies t*t*^ = the conditions ^ > and > are both obviously necessary for (IT^ 
to have a solution. 

Proof of Theorem] I'd Note that p is prime by assumption. Since ^ ^ and ^* ^ 0, we know that p ^ 0. Since x is 
odd and y is even, we have p = 1 (mod 4). Therefore, by Remark II 11 we can find G Z with p\h'^ + 1. Moreover, in 
Z[V2], we have <^ \p and therefore ^ | /i^ + 1. Let s — gcd(ft. + i,£_) in the ring Z[uj]. We claim that ss^ ^ 

First, note that ^ is prime in the ring Z[-\/2] by Remark [9l By definition of s, we know that s \ ^. But ^ is real, 
and therefore also s^ \ It follows that ss^ \ in Z[w]. By Remark[71 ss^ \ in Z[\/2]. Since ^ is prime in Z[\/2], it 
follows that one of three cases holds: 

(a) ss^ ^ 1. But this is impossible. Indeed, in this case, s is a unit, so h + i and ^ are relatively prime. As ^ is real, 
it follows that h — i and ^ are also relatively prime, hence (h + i){h — i) is relatively prime to ^, contradicting 

Cl/i' + i. 

(b) 38^ ^ ^. This is what was claimed. 

(c) ss^ ^ This is also impossible. Indeed, in this case, Afuj{s) = Aiy2{ss^) = J^i^,^) — -^uiiO- But we also have 
s\^, so ^ — us for some u G Z[-\/2]. Then Afuj{u) = A/Ij(^)/A/lj(s) — 1, hence u is a unit in Z[a/2], thus s ^ ^. 
Since, by definition, s\h + i, wc have ^ | /i + i. Since h is an integer, we have h — h' , and thus S^* \ h + i. We 
note that C / C*i fo^' otherwise, we would have p = \ + ~ 2x^ + Ay^ = Ax"^ — 2p; since p is an odd 
prime, this implies p \ x, and from p = x"^ — 2j/^, we get p \ y, hence p'^ \x^ — 2y^ — p, a. contradiction. Therefore, 
f and ^* are non-associate primes in Z[\/2], both dividing h + i, which implies p = \ h + i, an absurdity 
since ^{h + i) ^ Z[uj]. 

We have shown the existence of s G Z[uj] such that ss^ ^ ^ in Z[-\/2]. Let u be a unit of Z[a/2] such that uss^ = ^. 
Our next claim is that u is a square in Z[\/2]. First note that, by the usual properties of complex numbers, ss^ ^ 
and (ss^)' = (s*)(s')^ ^ 0. Also, ^ ^ and ^' ^ by assumption. It follows that u ^ and u* ^ 0. But then u is 
a square by Lemma fTOl Let v G Z[\/2] with v"^ ~ u, and let t — vs. Noting that v = v\ wc have ttt v^ss^ ~ ^, as 
desired. □ 

Remark 14. We note that the proof of Theorem [12] immediately yields an algorithm for computing t. As a matter 
of fact, the only randomized aspect is the computation of h; the remainder consists of arithmetic calculations in the 
various rings that can be done deterministically. The computation of s requires taking a greatest common divisor in 
Z[a;], which can be done efficiently by Remark [S] The computation of u requires a simple division in Z[\/2], and the 
computation of v requires taking a square root in Z['\/2], which easily reduces to solving a quadratic equation in the 
integers. Finally, the computation of t requires a multiplication in Z[w]. 

Remark 15. Theorem [T2l is analogous to a well-known theorem about the integers, stating that for every positive 
prime satisfying p = 1 (mod 4), the equation zz''^ = p has a solution with z G Z[i]. A randomized algorithm for 
computing z was described, for example, by Rabin and Shallit [10 . Our proof and algorithm follows the same 
general idea, applied to a different pair of Euclidean rings. 
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5 Approximations in Z[\/2] 



It is well-known that the set 1\\f% of integers of the form a = a + is a dense subset of the real numbers. Here, 
density is of course understood with respect to the Euclidean distance |a — We note that the Euclidean distance 
is not at all preserved by \/2-conjugation; in fact, as we will see in Lemma [TOl below, unless a = /3, it is impossible 
for |a — /3| and ja* — to be small at the same time. 

The purpose of this section is to find solutions in Z[\/2] to constraints involving a. and a* simultaneously. 
Specifically, we will be interested in solving problems of the form 

a + 6\/2 e [xo, xi] and a — &\/2 G [yo, (16) 

where xq < xi and i/q < yi are given real numbers, and a, b are unknown integers. We start with a result limiting 
the number of solutions. 

Lemma 16. Let [xo,xi] and [yo,yi] be closed intervals of real numbers. Let 5 — xi — xq and A = j/i — y^, and 
assume (5 A < 1. Then there exists at most one a = a + b^/2 e IW2] satisfying U^] . 

Proof. Suppose a and (3 are two solutions. Then 

|%(q - /3)| = |« - /3| • |a* - <5A < 1. (17) 

Since A(/2{a — (3) is an integer, it follows that /^{a — /?) = 0, and therefore a = (3. □ 

The next result establishes the existence of solutions. 

Lemma 17. Let [xo,Xi] and [yoiUi] be closed intervals of real numbers. Let S ~ Xi — Xq and A ~ yi — y^, and 
assume (5A ^ (1 + •\/2)^. Then there exists at least one a = a + 6\/2 G 1[\/2] satisfying \lb]) . Moreover, there is an 
efficient algorithm for computing such a and b. 

Proof. Let us say that a pair of positive real numbers {6, A) has the coverage property if for all x,y CzR, there exists 
a € Z[-\/2] with {a, a') £ [x,x + 6] x [y, y + A]. The goal, then, is to show that 6 A ^ (1 + \/2)^ implies the coverage 
property. 

Before we continue, it is perhaps helpful to consider the following illustration. Here, a is shown on the horizontal 
axis, and 6-\/2 is shown on the vertical axis. The region defined by (a + b\/2, a — b\/2) £ [x,x + 6] x [y, y + A] is a 
rectangle oriented at 45 degrees. We are only interested in solutions where a, b are integers; these solutions therefore 
lie on the grid Z x Note that the horizontal and vertical spacing are not the same. 



y y + A X X 5 

We prove a sequence of claims leading up to the lemma. 

(a) If ((5, A) has the coverage property and 5' ^ (5, A' ^ A, then (J', A') has the coverage property. This is a trivial 
consequence of the definitions. 

(b) For all (5, A > 0, the pair {5, A) has the coverage property if and only if (A, 5) has the coverage property. This 
is a trivial consequence of the definitions. 

(c) Let A = \/2 — 1. Then for all i5, A > 0, the pair (5, A) has the coverage property if and only if (A(5, A^^ A) has 
the coverage property. Indeed, note that < A < 1, and recall that A^^ — —A* — V2 + 1. Therefore both A 
and A~^ are elements of Z[a/2]. Suppose (5, A) has the coverage property, and a;, y G R are given. Then there 
exists a £ Z[V2] with [a, a') £ [\~^x, X~^x + (5] x [-Ay - A, -Ay]. Let (3 Aa. It follows that 

(/3, 13*) = (Aa, -A-^a') £[x,x + X&] x [y, y + A^^ A], (18) 

so (A^, A""'^ A) has the coverage property. The converse if proved symmetrically. 
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(d) A) = (1 + 72, V2) has the coverage property. GeometricaUy, this is equivalent to the statement that M 
is covered by all translations along the grid Z x ^/2Z of the rectangle R defined by (a + bV2,a — bV2) S 
[0,1 + ^/2] X [0,^2]. 

bV2^ 




In order to have an explicit algorithm for finding a, we give an algebraic proof. Let a, b be integers such that 

(19) 
(20) 



x + y + A 
a — 1 ^ < a, 



Let a = a + by/2, a' — a + (b+ l)\/2, and a" = (a — 1) + 6\/2. We claim that either a, a', or a" is a solution 
to (USD. 

• Case 1: a — 6\/2 ^ y + A. In this case, we have: 

a = a + ov 2 > 1 — x 



2 2 

, /t: a; + v + a x — y — A r- 
a = a + 6\/2 s$ 1 + 1 + 1 + V2 = 

x + y + A x-y- A r- 
^ 7, V2 = y 



6%/2 



> 



feV2 ^y + A 



by CI]) and (EOl), 

by IH]) and (EO]), 

by (dH) and (pO|. 
by assumption. 



Therefore, a is a solution to ((T? 
• Case 2: a — 6a/2 > y + A and a + b\/2 ^ x + 1. In this case, we have: 

; /, N x + y + A x — y — A r- 
a' ^a+{b+ 1) V2 > 1 + 1 + V2>x 

a' = a+{b+ l)V2 ^ x + I + V2 = x + S 

a'' ^a~{b+ 1) V2 >y + A-y/2 = y 

, /- X + y + A X — y — A /- 
a~{b+ 1) V2 < 1 + 1 1 V2 = 2/+l<j/ + A 



a" 



by (HH) and (HO]), 

by assumption, 
by assumption, 

by (dH) and (pT]). 



Therefore, o! is a solution to ([TO]) . 
• Case 3: a — 6\/2 > y + A and a + b\/2 > x + \. In this case, we have: 

a" = (a-l) + 6V2>a; 

a" = ( a - 1 ) + 6 72 ^ :^±|±^ + ^i^l^ + ^/2 < . + 5 
a"' = (a - 1) - 6V2 > y + A - 1 > y 
a =(a-l)-6V2s^ ^ ^ = y + A 

Therefore, a" is a solution to (fl 



by assumption, 
by HID and (HOI), 
by assumption, 
by (Hll) and ([20|. 



(e) (5, A) = (2 + \/2, 1) has the coverage property. This follows from (b)-(d), by noting that 2 + \/2 = A ^\/2 and 
1 = A(l + V2). 
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(f) Suppose 5 A ^ (1 + \/2)^ and 1 < (5 ^ 1 + V2. Then {S, A) has the coverage property. We consider two cases. 
Case 1: S> V2. bmce we have A ^ 1 + \/2- But {V2, 1 + \/2) has the coverage property by (d), 
so the claim foUows from (a). Case 2: 6 ^ \f2. Then 

A^ii±^>2 + y2. (21) 
v2 

Also (5 > 1. But (1, 2 + a/2) has the coverage property by (e), so the claim follows from (a). 

(g) Suppose (5, A > such that (5A ^ (1 + . Then (5, A) has the coverage property. Indeed, note that there 
exists some n e Z such that 1 < A" (5 ^ A^^ = 1 + v^. Then (A"(5, A~"A) has the coverage property by (f), 
and ((5, A) has the coverage property by (c). 

This finishes the proof of the lemma. Note that in each step of the proof, we have shown explicitly how to compute a 
solution a. Since there are no iterative constructions (apart from the computation of A" in (g), which can be done in 
0(1 log ((5) I) steps), the computational effort is essentially trivial, and certainly not greater than say 0(log^((5)). □ 

Remark 18. We note that the bounds on (5A in Lemmas [T51 and [T71 are sharp. For the sharpness of Lemma [T^ 
consider (a, a*) € [0,1] x [0,1], which has two solutions a G {0,1}. For the sharpness of Lemma [T71 consider 
(a, a*) e [0, 1 + a/2] x [-\/2, 1], which has exactly four solutions a € {0, 1, ^2, 1 + \/2}. Therefore, for all e > 0, 
(a, a*) e [e, 1 + a/— e] x [— + e, 1 — e] has no solutions at all. 

We also give a version of Lemma [T71 where a is restricted to be either even or odd: 

Corollary 19. Let \xq^x-\\ and [yo,yi] be closed intervals of real numbers. Let S — xi — xq and A — yi — y^, and 
assume 5 A ^ 2(1 + \/2)^- Then there exist a', &' e Z such that a' + 6'\/2 G [xq, xi] and a' — b'\/2 £ [yo, yi], and a' is 
even. There also exist a", b" e Z such that a" + b"\/2 e [xq, xi] and a" — b"y/2 € [yo, yi], and a" is odd. Moreover, 
there is an efficient algorithm for computing such a! , b' , a" , and b" . 

Proof. This is proved by rescaling. To prove the first claim, use Lemma [T7] to find a,b £ Z with a + b^/2 £ 
[xo/V2,xi/V2] and a-6\/2 £ [~yi/V2,-yo/V2]. Let a' = 2b and 6' = a. Then we have a' + b'V2 = V2{a + bV2) £ 
[xo, xi] and a' — b'\f2 = —\f2 (a — 6a/2) £ [yo, J/i], as desired. To prove the second claim, use the first claim to find 
a! + 6' a/2 £ {xq - 1, xi - 1] and a! - b'V2 £ [yo - 1, yi - 1], with a' even; then let a" = a' + 1 and b" = b'. □ 

6 Approximation up to e 

As mentioned in Section [21 given 9 and e, we wish to find fc ^ and u,t £ Z[a;] such that 
satisfies \\U — Rz{9)\\ ^ e. We now elaborate how to determine fc, m, and t. 



6.1 The e-region 

We first examine how to express the error e as a function of u; this will make explicit the set of available u for a 
given e. Let z = x + yi = e~*^/^. First note that, since both U and Rz{0) are 2x2 unitary of determinant 1, the 
operator norm oiU — Rz [0) coincides with 1 / a/2 of the Hilbert-Schmidt norm, which can therefore be calculated as 
follows. Let u' — —priTU = a + bi and t' = — =t^- 

V 2 a/2 

\\u - RMf = \\\u- RMWls = I"' - + l^f • (22) 

Using u'u'^ + t't''^ — 1 and zz^ — 1, we can further simplify this to: 
|u' - z|2 + |<f = [u' ~ z){u' - z)t + t't'^ = u'u'^ - u'z^ - zu'^ + zzt + t't't = 2-2 Rc(u'z^) = 2- 2(^)-(j). (23) 

The error is therefore directly related to the dot product of u and z, regarded as vectors in R^. Writing z = (x, y)"^ 
and u = (a, &)"^, we have 

||C/ - Rz{OW ^ 2 - 2u • z u • z ^ 1 - — . (24) 
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Let us define the e-region for z to be the corresponding subset of the unit disk. Let V = {\i \ |up < 1} be the 
closed unit disk. Then 

_ e2 

7^e = {ue2?|u•z^l--}. (25) 

2 

The e-region is shown as a shaded region in the illustration below. Note that the width of this region is ^ at its 
widest point, and its length, to second order, is 2e, and in any case greater than \/2e. 



i 










/ V 








w 2e\V 














2 









In summary, \\U — Rz{0)\\ ^ e if and only if u e TZ^- 

From now on, it will be convenient to identify the complex plane with M^, i.e., we will regard T> and TZe as subsets 
of the complex numbers as well as M^. 

6.2 Candidates 

Assume, for the moment, that some suitable fc ^ 1 has been fixed. The problem of finding an e-approximation of 
Rz{0) can now be reduced to the following 2-step problem: 

(a) find u (z such that u' = u/\/2 is in the e-region, and 

(b) find t e Z[oj] such that tt^ + mu^ = 2*^. 

Recall from Section |4] that we have an efficient solution to (b) if ^ = 2'^ — uu^ satisfies the hypotheses of Theorem [T2l 
We will quite literally leave one of these hypotheses, namely the primality of A(/2(0) to chance. However, we will 
arrange things such that the remaining hypotheses are satisfied by design. To that end, we will say that u' is a 
candidate if it satisfies all the required conditions, except possibly for the primality of A^(C). This is made precise 
in the following definition and lemma. 

Definition 20. Let e > 0, 6* G K, and fc ^ 1 be fixed. Let u' = u/V^'', where u e Z[uj]. Let ^ = x + yV2 = 2''-uu^. 
Then u' is called a candidate if u' € 7?.e, x is odd, y is even, ^ 0, and ^' 0. We say that u' is a prime candidate 
if, moreover, p = is prime. 

We will further restrict attention to candidates u' — u/ \f2 where u is from the ring l^sf^^ i] C Z[a;], i.e., of the 
form ?i = a + /3i with a, /3 G TL\\f%. 

Lemma 21. LeA u' — u/V^ , where u ^ a + f3i and a, P e Z[%/2] . Let us write a ^ a + bV2 and P ^ c + d%/2. 
Then u' is a candidate if and only if the following three conditions hold: 

• u'' e D, and 

• a + c is odd. 

Proof. With the given choice of notation, we have 

^ = 2*^ - uu'f 

^2"" -a^ -f (26) 
= (2*^ -a^ - 26^ - - 2d^) - {2ab + 2cd)V2, 

hence x = 2''' — — 2b^ — — 2d^ and y = 2{ab + cd). Then x is odd if and only if a -f c is odd. The condition 
that y is even is automatically satisfied. The condition ^ ^ is equivalent to uu^ ^ 2*^, or equivalently u'u'^ ^ 1, 
i.e., u' e V, which follows from u' € TZe. Similarly, ^* ^ is equivalent to u' £ V. □ 
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6.3 Candidate selection 



Theorem 22. Let e > and be fixed, and let k ^ C + 21og2(l/e), where C = 3 + 21og2(l + \/2). Then there 
exists a set of at least n = [^-^J candidates u' satisfying the conditions of Lemma \21\ Moreover, there is an efficient 
algorithm for computing a random candidate from this set. 



Proof. Define 



i-k e . ^k+l 

(5 = \/2 — and A = \/2 



We first note tliat S and A satisfy tlie condition of Lemma [TT] Indeed, 

5A 



o e o 



(27) 



(28) 



In tlie following, we will assume, for convenience, that —^^9^^. This assumption is without loss of generality, 
because otherwise, we may simply rotate the e-region by multiples of 90° without changing the substance of the 
argument. 

Now consider the line u • z = 1 — 6^/4. It intersects the unit circle in two points at y-coordinates j/min and ^max, 
with j/max - ymin ^ 7f ' ^s showu in this figure: 




Consider the parallelogram Ve that is bounded by the lines u-z = 1 — and u-z = 1 — 6^/2, and by the horizontal 
lines at y = j/min and y = ?/max- As illustrated in the above figure, Ve is entirely contained within the e-region. We 
will select candidates from within V^. 

Let n = [^J , and define y^ = y^^n + ^(2/max - Vmin) for j = 0, . . . , n, so that j/i„i„ = < ?/i < • • ■ < 2/n = 2/max- 
We note that 



Vj+i - Vj 



Vn 



Vn 



> 



V2 4\/2 8 



(29) 



mm , ^max 



Let Ij = [yj, yj + ^] for j = 0, . . . , n — 1. Then /q, . . . , In-i are non-overlapping closed subintervals of [y 
of size For each j = 0, . . . , n — 1, we will find a candidate u' € T'e n (R x Ij) as follows. 

First, use Lemma [IT] to find (3 e Z[V2] such that /3 e [V2''yj,V2'' (yj + ^)] and /?' G [-\/2 \/2 ''^ ^ 
Note that these two intervals are of size 5 and A, respectively, so the use of Lemma [TTl is justified by (|28| . Let 

/3' = /3/V2'e/,. 

Because /?' e [ymin, 2/max], the line y = /3' intersects the parallelogram Ve, as shown in the figure below. Let 
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xo — minja; | (a;,/?') G Ve} and xi = maxja; | {x,l3') S Ve}, and note that xi — xq ^ ^. 




Use Corollary [H to find a e Z[V2] such that a G [V2''xo,V2''{xo + ^)] and a* S [-^2'' \\/2'' ^ Note that 
these two intervals are of size 25 and A, respectively, so that the use of Corollary [12] is again justified by (|28p . 
Furthermore, writing a — a + h\f2 and /? = c + (i-\/2. Corollary [T9l permits us to choose a odd if c is even, or vice 
versa. ^ 

Let a' = a/-\/2 , and let u' = a' + It is now trivial to show that v! is a candidate. Indeed, since a' € [xq, xi], 
we have that u' G T'e C T?.,: by construction. Also, note that, by construction, (a'*,/3'*) G [~"^: "^1^ ^ so that 

m'* G I?. Finally, we already remarked that a + c is odd. 

Since we have found a distinct candidate for each j G {0, . . . , n — 1}, there exist at least n candidates; moreover, 
the construction of the jth candidate is clearly algorithmic. □ 



7 The main algorithm 

7.1 Approximating a z-rotation 

We are now ready to put together the results of earlier sections to obtain an algorithm for approximating Rz{0) up 
to e, using only gates from the single-qubit Clifford+T group. 

Algorithm 23. Inputs: < e i and G M. Let fc = [C + 2 log2(l/e)l , where C = 3 + 21og2(l + V2) « 5.54, 

and let n — [^^\. Use Theorem [22] to generate random candidates u' G -^Z[a;]. For each candidate u' — u/v^*^, 

let ^ = 2*^ — uu"^ G TL\\f% and attempt to use the method of Theorem [12] to find i G Z[w] with tt^ = ^. If this fails, 
continue with the next candidate. If it succeeds, the operator 



72'^ 

is the desired e-approximation of Rz{d). Use the Kliuchnikov-Maslov-Mosca exact synthesis algorithm to convert 
[/ to a sequence of Clifford+T gates; optionally, reduce the sequence of gates to Matsumoto-Amano normal form [9]. 
Output: the sequence of gates. 

Remark 24. It is not necessary to limit the generation of candidates to the particular set of n candidates identified 
in Theorem 1221 Instead, one can simply generate candidates at random until a solution is found. 

Remark 25. Although the method of Theorem [T^ will usually only work when p = is prime. Algorithm [53] 
requires no explicit primality test. Instead, one can simply perform the method of Theorem 1121 under the optimistic 
assumption that p is prime. In the worst case, this may yield a t that is not a solution, but this can be easily checked 
after the fact. Some slight care is needed to ensure that the probabilistic algorithm from Remark [11] for finding a 
square root /i of — 1 modulo p, does not get into an infinite loop when p is not prime. For this, it is sufficient to limit 
the number of iterations of this algorithm to some small number, say 1 or 2. If p is indeed prime, this will still yield 
h with high enough probability; in the worst case, some prime candidates will be unnecessarily rejected. 
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7.2 Approximating arbitrary gates 



To approximate an arbitrary gate U E SU{2), first decompose it via Euler angles a.s U ~ Rz{l3)Rx{l)Rz{5) = 
Rz{l3) H Rz{j) H Rz(6); each rotation can then be approximated separately, say up to e/3. 

Remark 26. If one includes, as we did, only global phases of the form in the Clifford group, it is of course not 
possible to approximate unitary operators whose determinant is arbitrary, using only single-qubit Clifford+T gates. 
Since the determinant of every Clifford+T operator is a power of w, an operator U € U(2) can be approximated to 
arbitrary e if and only if det U is also a power of w. Otherwise, U can only be approximated up to a global phase. 
Had we included arbitrary global phases in the Clifford group, then of course all operators could be approximated. 



8 Complexity analysis 
8.1 Gate complexity 

Since the matrix U constructed by Algorithm 1231 has denominator exponent fc, the approximation of a z-rotation 
uses T-count at most 2k, or 2C + 41og2(l/e). The approximation of an arbitrary element of SU{2) requires T-count 
C' + 121og2(l/e). 

Remark 27. Rotations about other "easy" axes, such as a;-rotations or y-rotations, can of course also be approx- 
imated with the same T-count as a z-rotation, as they differ from a z-rotation only by Clifford operators. More 
generally, rotations of the form VRz{0)V'' , where F is a fixed Clifford+T-operator, can be approximated with T-count 
K + 41og2(l/e), where if is a constant depending only on V. 



8.2 Time complexity 

Most parts of the algorithm are computationally straightforward; for example, the generation of candidates, and 
the various ring operations required for Theorem 1121 can all be done with integers of length 0{k). The arithmetic 
operations, such as addition, multiplication, division, etc., require no more than 0(k^) elementary steps each, and 
there are 0{k) arithmetic operations to perform. 

The dominant complexity question is how many candidates must be generated before a solution is found, and 
indeed, whether a solution will be found at all. Here, we must make an assumption about the distribution of primes: 

Hypothesis 28. For a randomly chosen candidate, the probability that p = is prime is asymptotically no smaller 
than for general odd numbers of comparable size. 

We note that for a candidate u' = u/\/2^ , we have 

^v^^ (^l-^)%l-6^ (30) 

e = 2'^-uut ^ 2\l~ u'u'^) ^ 2"^^ < Mi±^ ^2 ^ 16(H- 72)2 ^ 100. ^3^) 



and thus 



Also, ^* = 2'^ — ^2'^. It follows that p — ^ 100 • 2^ . By the prime number theorem, a randomly chosen 

odd p in this range has probability 

^-Ri(|:2^ = "(i/^) ^^2) 

of being prime; by Hypothesis [251 at least the same probability holds for a randomly chosen candidate. On the other 

hand, there are n — [^-^J = 0{^\f2 ") candidates available, so asymptotically, a prime will be found with certainty. 
The expected number of top-level iterations of Algorithm 1231 until a solution is found is 0{k). Therefore, under 
Hypothesis HSl the overall runtime of the algorithm is no more than 0{k^) = 0(log'*(l/e)). A sharper bound could 
probably be derived by a more sophisticated analysis. 

We also note that, due to its randomized nature, and because each candidate is chosen independently, the 
algorithm can easily be parallelized. 
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8.3 Seeding 



While the above discussion concerns the asymptotic case, one may wonder whether for particular values of e and 6 it 
may happen, by unlucky coincidence, that none of the available candidates are prime. In practice, this never seems 
to be the case, as primes are always found quite quickly. However, in theory, we may avoid this situation by the 
method of seeding: Instead of approximating (9) directly, we may choose a random angle ( "seed" ) 4>, approximate 
both Rz{(t>) and Rz{0 ~ (f>) to within e/2, and finally compute Rz{d) as Rz{(p)Rz{d ~ (f>)- If a particular seed seems 
to yield no prime candidates in a given number of iterations, one can simply try a different seed. 

The seeding method for z-rotations has the disadvantage that it approximately doubles the T-count, from 2C + 
41og2(lA) to 4C + 81og2(l/e). 

In the approximation of an arbitrary gate U G SU{2), a different seeding method can be used, which only increases 
the asymptotic T-count by a small additive constant. Namely, let the seed be some randomly chosen Clifford-|-T 
operator V of fixed and relatively small T-count. We can then use the algorithm to approximate UV'^^, and multiply 
the final result by V. The gate complexity, in this case, is unchanged at K + 121og2(l/e). 

It must be emphasized, once again, that seeding is only of theoretical interest, to ensure expected termination of 
the algorithm midcr a hypothetical worst-case scenario. In practice, it does not seem to be required. 



9 Lower bounds 

As mentioned in the introduction, K + 31og2(l/e) is an easy lower bound for the T-count of a Clifford-|-T approx- 
imation of some arbitrary operator in SU(2) up to e, for some constant K. Specifically, Matsumoto and Amano 
showed that there are precisely 192 • (3 • 2" — 2) distinct single-qubit Clifford-|-T-circuits of T-count at most n |9]. 
Since SU{2) is a 3-dimensional manifold, it requires 0,(1 /e^) epsilon-balls to cover. The resulting inequality 

192- (3-2"-- 2) ^ ^, (33) 

immediately implies 

n ^ ii: + 31og2(l/e). (34) 

This means that there is some universal constant K such that for every e, there exists some operator U E SU{2) that 
cannot be approximated up to e with T-count less than K + 3\og2{l/e). In fact, (j33|) implies that the proportion (in 
the Haar measure, say) of operators that can be approximated with T-count K + 31og2(l/e) — fc is at most O(^), 
so that "most" operators require T-counts that are close to or above the lower bound. 

However, like all lower bounds, this must be understood with a grain of salt. For example, the set of z-rotations 
only forms a 1-dimensional submanifold of SU{2), so it is not a priori clear that the lower bound oi K + 31og2(l/e) 
also applies to z-rotations. 

We now prove a sharper lower bound, which applies to z-rotations in particular. 

Theorem 29. Let K' = —9. Then for all e > 0, there exists an angle 6 such that every t- approximation of Rz{0) 
by a product of Clifford+T operators requires T-count at least K' + 41og2(l/e). 

Proof. Let e be given. If e ^ 1/2, then K' + 41og2(l/e) is negative, so there is nothing to show. Assume, therefore, 
that e < 1/2. Let = sin^^ e, with < < 7r/6. Let 9 = -20, so that z = e~*^/^ = e^"^ . We note the shape of the 
e-region for z: 




Identifying complex number with vectors in as before, we estimate the dot product 



1-z = cos(/)= yr~^< yi-e2 + 1- = 1 _ 1.. (35) 
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It follows that neither 1 nor is in the e-region. We further note that the x-coordinate of is cos — 1 — 2 sin^ = 

1 — 2e^. So for all x + iy E TZ^, we have 

1 - 2e2 < x < 1. (36) 

Now consider some e-approximation 

of Rz{0) with denominator exponent fc, i.e., where u, t, s,v €z Z[iuj]. By the same reasoning as in Section [6.1[ it follows 
that u' = ul\f2^ is in the e-region. Moreover since U* is also unitary, we have v!* G T). We can write 

v! = -^{au? + hiJ- + cw + d) = — ^r— r((iV2 + c - a) + (5^2 + c + a)i = — i-rT(" + /^i), 
V2 V2 V2 

where a,/3 G 'L[\/2]. Since m' G 7?.e, from ([BG)) . we have 

V2''^\l - 26^) < a < V2''^\ (38) 

Also, from u'' G P, we have 

a'G[-V2 ,V2 ]. (39) 

It follows that the constraints 

(7,7*) (l-2e2),y2 ]x[-y2 , ^2 ] (40) 

/c-j- 1 I— h I 1 

have at least two different solutions in Z[\/2], namely j — a and 7 = V2 . Setting S = v2 2e^ and A = 

2 v2 , we have by Lemma \Wi 

l^SA^ 2''+h\ (41) 

or equivalently, 

fc^log2(^)--3 + 21og2(i). (42) 

On the other hand, it is a fact that every single-qubit Clifford+T operator U of T-count n can be written with 
denominator exponent /c, where 

k ^ (43) 

This can be shown by an easy induction on the Matsumoto-Amano normal form of U. Putting together (|42p and 
(P)) . we get 

7i^-9 + 41og2(l/6), (44) 

which is the desired result. □ 



Remark 30. Unlike the lower bound ([34|) . which applies to typical operators, the lower bound (|44|) only applies 
to carefully chosen worst-case operators. It is plausible that for any fixed e, approximations of order p4l) can be 
achieved for most angles 9. Moreover, it is also plausible that for any fixed 9, approximations of order ([M)) can be 
achieved as e — >■ 0. A variation of Algorithm [23] that could potentially achieve this is sketched in Section lOTTl but the 
details are left for future work. 



9.1 Overclocking 

It is in the nature of Algorithm [531 that k is chosen at the very beginning; the final sequence of gates will have 
T-count very close to 2k. This behavior is different from that of search-based algorithms, which would typically try 
shorter decompositions first, and then gradually move to longer ones. 

In practice, many of the approximations and estimates in the above proofs are conservative; it is often possible to 
choose a smaller k than that prescribed by the algorithm, and still obtain a decomposition. I refer to this technique 
as "overclocking" the algorithm, by analogy with the practice of running microprocessors at higher clock speeds than 
they were designed for, and hoping for the best. 

Let us first consider the effect of overclocking by a small additive constant, i.e., decreasing the value of C 
in Algorithm [23| by some fixed amount, independently of e. This decreases the width of the e-region by a fixed 
multiplicative factor, which means that some choices of /3 (in Theorem I22|) will no longer yield a successful solution 
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e 


k 


T- count 


Actual 


error 


Runtime 


Candidates 


Time / C andidate 


10 


— b 


39 


78 


0.44893 • 


lO"'^ 


0.95s 


22.4 


0.0425s 


10 


— 10 


72 


144 


0.96870 • 


10 ^0 


2.15s 


33.2 


0.0649s 


10 


— 15 


106 


210 


0.88883 • 


10 '-^ 


4.75s 


58.7 


0.0810s 


10 


—20 


139 


276 


0.52510 • 


10 


7.24s 


70.4 


0.1028s 


10 


— 30 


205 


408 


0.69955 • 


10 -^^ 


16.1s 


79.4 


0.2028s 


10 


—40 


272 


542 


0.79661 • 


10-40 


35.52s 


104.7 


0.3391s 


10 


-50 


338 


676 


0.59046 • 


10-50 


103.78s 


206.9 


0.5016s 


10 


— 60 


405 


810 


0.84614 • 


10-60 


107.58s 


145.0 


0.7421s 


10 


-70 


4:1 L 


940 


0.9UU8O • 


1 A-70 
iO 


1 O O A ^ 

218. o9s 


1 A A 

ziy.4 


A A A C y1 ^ 

0.9954s 


10 


-80 


538 


1076 


0.93224- 


10-80 


352.44s 


267.8 


1.3162s 


10 


-90 


604 


1206 


0.82986 • 


10-90 


518.85s 


298.2 


1.7399s 


10 


-100 


670 


1338 


0.96584 • 


10-100 


715.57s 


330.6 


2.1647s 



Table 1: Experimental results. The operator approximated is Rz{0.1). Errors are measured in the operator norm. 
The runtime is averaged over 50 independent runs of the algorithm with the same parameters. The runtime is further 
broken down into average number of candidates tried per run of the algorithm, and time spent per candidate. 



for a. However, the proportion of /3 for which an a can be found will be asymptotically independent of e, so that 
the algorithm will still yield a solution, albeit with a longer running time. In summary, the asymptotic effect of 
overclocking C by a fixed additive amount is to increase the runtime by a fixed factor, while neither affecting the 
validity nor the big-0 time complexity of the algorithm. 

A more interesting question is whether the algorithm can be modified to allow overclocking by a multiplicative 
factor; in the ideal case, one might even hope to achieve approximations with T-count K + 3 log2(l/e), for most angles 
9. As it is currently stated, the algorithm will not work well for multiplicative overclocking, because the e-region will 
then be much too thin to expect to find candidates for a reasonable fraction of y-coordinates /?. However, the area of 
the e-region scales as e^, and since the density of grid points scales as A'^ ^ one still expects, on average, to find 
a constant number of candidates in the e-region. This assumes that the angle 9 is sufficiently general, so that the 
e-region is not aligned with the orientation of the underlying fc-grid, so that the lower bound of Theorem can be 
avoided. It would be an interesting optimization to refine Algorithm [23] to be able to take advantage of such sparsely 
populated e-regions, but the details are left to future work. 



10 Experimental results 

An experimental, non-optimized implementation of Algorithm [23] has been realized in the Haskell programming 
language. Table [T] summarizes the results of approximating i?z(0.1) up to various e on a laptop computer with a 
1.3GHz CPU. 

We may note that the runtime per candidate increases predictably, and polynomially, with decreasing e, due to 
the increasing size of the integers and real numbers that must be operated upon. The number of candidates tried 
per run of the algorithm is approximately proportional to k, which is how to should be according to (|32p . This lends 
some empirical evidence to the validity of Hypothesis [28l 

Note that we obtained a decomposition with accuracy e = lO^^o^^ using only 1338 T-gates. By comparison, the 
Solovay-Kitaev algorithm with comparable T-count achieves less than e ~ lO^^^ [gj Table 2]. 

As an example, here is the decomposition of Rz{0.1) up to e = 10"^: 

u' = (-139526cj3 - 24293^2 + 226284a; + 481862) 

\/2 

t' = (298053a;3 - 79767^2 - 185246a; + 341743) 

V2 

U = TSHTSHTSHTHTHTSHTSHTSHTHTHTHTHTSHTHTSHTHTSHTHTSHTHTSHTSHTHTSHTSHTSHT 
HTSHTSHTHTSHTSHTSHTHTHTHTSHTHTHTSHTHTHTSHTHTHTHTHTHTSHTHTHTSHTHTSHTS 
HTSHTSHTSHTHTSHTHTSHTSHTSHTSHTHTHTSHTSHTHTSHTSHTSHTHTHTSHTHTXSSSo; 

The remaining decompositions from Table [T] will be made available as supplemental materials on the arXiv. 
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11 Conclusions 



We have given the most efficient algorithm to date for decomposing an element of SU{2) into a product of Clifford+T 
gates, up to arbitrarily small e. The algorithm performs well both in theory and in practice, easily achieving 
decompositions up to e = 10"^"° using T-counts of less than 1400. 

Like the recent ancilla-based algorithm by Kliuchnikov, Maslov, and Mosca [7], our algorithm is based on solving 
a Diophantine equation. Although both algorithms achieve the same optimal asymptotic big-0 complexity, the gate 
decompositions resulting from our algorithm are shorter (by a constant, but non-negligible factor) than those that 
can be achieved by the Kliuchnikov-Maslov-Mosca approximation algorithm. 
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